Post #4231169
2026-07-30 06:53 UTC
I found a cool little Android app for interactions with hardware security keys.
It's called Passchain and it allows the keys to work, without needing Google Play Services (Passchain uses parts of MicroG).
This part is also done by another app, that I used previously, called AuthnKey.
But what makes Passchain fun is that it also supports scanning QR codes on other devices to do the signin with a security token that's connected to or scanned by the phone.
Now I don't see that much practical use for this, because in the majority of cases I could just connect the token directly to the other device instead, but it’s still fun to see this implemented :D
In the video you can see me using a YubiKey attached to my phone to login to my kanidm on a laptop.
Also don't be like me and give the app Network permissions from the start and enable Bluetooth, otherwise it won't work. I was confused about that for a good bit :neobot_woozy:
https://codeberg.org/s1m/hw-fido2-provider
Replies (2)
-
@arichtman@eigenmagic.net 2026-07-30 07:00
FYI @firstyear@infosec.exchange - neat!
-
@firstyear@infosec.exchange 2026-07-30 07:26
@jana@social.jsteuernagel.de Ahh it looks like what happens is that a caBLE tunnel is setup (which btw, still goes via google, sorry to let you know). Then via that caBLE tunnel, your phone can use the yubikey to sign the request since cable is pretty much ctap2-over-noise-tunnel-started-by-bluetooth-qr-magic.